Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2021-37366: CTparental before 4.45.03 is vulnerable to cross-site request forgery (CSRF) in the CTparental admin panel. By combining CSRF with XSS, an attacker can trick the administrator into clicking a link ...
CVE-2021-37366 · published 5 years ago
Summary
CTparental before 4.45.03 is vulnerable to cross-site request forgery (CSRF) in the CTparental admin panel. By combining CSRF with XSS, an attacker can trick the administrator into clicking a link that cancels the filtering for all standard users.
What to do
- Update ctparental_project ctparental to version 4.45.03 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ctparental_project | ctparental |
< 4.45.03 cpe:2.3:a:ctparental_project:ctparental:*:*:*:*:*:*:*:* |
Original advisory text
CTparental before 4.45.03 is vulnerable to cross-site request forgery (CSRF) in the CTparental admin panel. By combining CSRF with XSS, an attacker can trick the administrator into clicking a link ...
CTparental before 4.45.03 is vulnerable to cross-site request forgery (CSRF) in the CTparental admin panel. By combining CSRF with XSS, an attacker can trick the administrator into clicking a link that cancels the filtering for all standard users.
References
- https://gist.github.com/securylight/092ba96a660e07ad76f2a380c2eaa75a Third Party Advisory
- https://gitlab.com/marsat/CTparental/ Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published10 Aug 2021
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-37366 · NVD
Track software like this
Free during beta